--- /dev/null
+From b9a5e5e18fbf223502c0b2264c15024e393da928 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 7 May 2015 21:19:39 +0200
+Subject: ACPI / init: Fix the ordering of acpi_reserve_resources()
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit b9a5e5e18fbf223502c0b2264c15024e393da928 upstream.
+
+Since acpi_reserve_resources() is defined as a device_initcall(),
+there's no guarantee that it will be executed in the right order
+with respect to the rest of the ACPI initialization code. On some
+systems this leads to breakage if, for example, the address range
+that should be reserved for the ACPI fixed registers is given to
+the PCI host bridge instead if the race is won by the wrong code
+path.
+
+Fix this by turning acpi_reserve_resources() into a void function
+and calling it directly from within the ACPI initialization sequence.
+
+Reported-and-tested-by: George McCollister <george.mccollister@gmail.com>
+Link: http://marc.info/?t=143092384600002&r=1&w=2
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/osl.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -172,7 +172,7 @@ static void __init acpi_request_region (
+ request_mem_region(addr, length, desc);
+ }
+
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ "ACPI PM1a_EVT_BLK");
+@@ -201,10 +201,7 @@ static int __init acpi_reserve_resources
+ if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+- return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1792,6 +1789,7 @@ acpi_status __init acpi_os_initialize(vo
+
+ acpi_status __init acpi_os_initialize1(void)
+ {
++ acpi_reserve_resources();
+ kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
--- /dev/null
+From fcf3b54282e4c5a95a1f45f67558bc105acdbc6a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 12 May 2015 12:51:38 -0400
+Subject: drm/radeon: add new bonaire pci id
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fcf3b54282e4c5a95a1f45f67558bc105acdbc6a upstream.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_pciids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -186,6 +186,7 @@
+ {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
--- /dev/null
+From 607d48063512707a414e346972e2210dc71ab491 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Tue, 12 May 2015 14:56:17 +0200
+Subject: drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 607d48063512707a414e346972e2210dc71ab491 upstream.
+
+The mapping range is inclusive between starting and ending addresses.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 4 ++--
+ drivers/gpu/drm/radeon/evergreen.c | 2 +-
+ drivers/gpu/drm/radeon/ni.c | 5 +++--
+ drivers/gpu/drm/radeon/r600.c | 2 +-
+ drivers/gpu/drm/radeon/rv770.c | 2 +-
+ drivers/gpu/drm/radeon/si.c | 4 ++--
+ 6 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -5342,7 +5342,7 @@ static int cik_pcie_gart_enable(struct r
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -5360,7 +5360,7 @@ static int cik_pcie_gart_enable(struct r
+ */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ for (i = 1; i < 16; i++) {
+ if (i < 8)
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2474,7 +2474,7 @@ static int evergreen_pcie_gart_enable(st
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1237,7 +1237,7 @@ static int cayman_pcie_gart_enable(struc
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -1256,7 +1256,8 @@ static int cayman_pcie_gart_enable(struc
+ */
+ for (i = 1; i < 8; i++) {
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2),
++ rdev->vm_manager.max_pfn - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+ rdev->gart.table_addr >> 12);
+ }
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -996,7 +996,7 @@ static int r600_pcie_gart_enable(struct
+ WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -916,7 +916,7 @@ static int rv770_pcie_gart_enable(struct
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4069,7 +4069,7 @@ static int si_pcie_gart_enable(struct ra
+ L2_CACHE_BIGK_FRAGMENT_SIZE(0));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -4084,7 +4084,7 @@ static int si_pcie_gart_enable(struct ra
+ /* empty context1-15 */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ /* Assign the pt base to something valid for now; the pts used for
+ * the VMs are determined by the application and setup and assigned
+ * on the fly in the vm part of radeon_gart.c
--- /dev/null
+From 7c0411d2fabc2e2702c9871ffb603e251158b317 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 28 May 2015 15:51:59 +0200
+Subject: drm/radeon: partially revert "fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 7c0411d2fabc2e2702c9871ffb603e251158b317 upstream.
+
+We have that bug for years and some users report side effects when fixing it on older hardware.
+
+So revert it for VM_CONTEXT0_PAGE_TABLE_END_ADDR, but keep it for VM 1-15.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 2 +-
+ drivers/gpu/drm/radeon/evergreen.c | 2 +-
+ drivers/gpu/drm/radeon/ni.c | 2 +-
+ drivers/gpu/drm/radeon/r600.c | 2 +-
+ drivers/gpu/drm/radeon/rv770.c | 2 +-
+ drivers/gpu/drm/radeon/si.c | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -5342,7 +5342,7 @@ static int cik_pcie_gart_enable(struct r
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2474,7 +2474,7 @@ static int evergreen_pcie_gart_enable(st
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1237,7 +1237,7 @@ static int cayman_pcie_gart_enable(struc
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -996,7 +996,7 @@ static int r600_pcie_gart_enable(struct
+ WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -916,7 +916,7 @@ static int rv770_pcie_gart_enable(struct
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4069,7 +4069,7 @@ static int si_pcie_gart_enable(struct ra
+ L2_CACHE_BIGK_FRAGMENT_SIZE(0));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
--- /dev/null
+From 2b1d3ae940acd11be44c6eced5873d47c2e00ffa Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Thu, 28 May 2015 15:44:24 -0700
+Subject: fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 2b1d3ae940acd11be44c6eced5873d47c2e00ffa upstream.
+
+load_elf_binary() returns `retval', not `error'.
+
+Fixes: a87938b2e246b81b4fb ("fs/binfmt_elf.c: fix bug in loading of PIE binaries")
+Reported-by: James Hogan <james.hogan@imgtec.com>
+Cc: Michael Davidson <md@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/binfmt_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -819,7 +819,7 @@ static int load_elf_binary(struct linux_
+ total_size = total_mapping_size(elf_phdata,
+ loc->elf_ex.e_phnum);
+ if (!total_size) {
+- error = -EINVAL;
++ retval = -EINVAL;
+ goto out_free_dentry;
+ }
+ }
--- /dev/null
+From 3c0213d17a09601e0c6c0ae0e27caf70d988290f Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Thu, 23 Apr 2015 09:08:43 -0700
+Subject: Input: elantech - fix semi-mt protocol for v3 HW
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 3c0213d17a09601e0c6c0ae0e27caf70d988290f upstream.
+
+When the v3 hardware sees more than one finger, it uses the semi-mt
+protocol to report the touches. However, it currently works when
+num_fingers is 0, 1 or 2, but when it is 3 and above, it sends only 1
+finger as if num_fingers was 1.
+
+This confuses userspace which knows how to deal with extra fingers
+when all the slots are used, but not when some are missing.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90101
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elantech.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -314,7 +314,7 @@ static void elantech_report_semi_mt_data
+ unsigned int x2, unsigned int y2)
+ {
+ elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+
+ /*
--- /dev/null
+From 414b7e3b9ce8b0577f613e656fdbc36b34b444dd Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 24 Apr 2015 11:03:37 -0500
+Subject: rtlwifi: rtl8192cu: Fix kernel deadlock
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 414b7e3b9ce8b0577f613e656fdbc36b34b444dd upstream.
+
+The USB mini-driver in rtlwifi, which is used by rtl8192cu, issues a call to
+usb_control_msg() with a timeout value of 0. In some instances where the
+interface is shutting down, this infinite wait results in a CPU deadlock. A
+one second timeout fixes this problem without affecting any normal operations.
+
+This bug is reported at https://bugzilla.novell.com/show_bug.cgi?id=927786.
+
+Reported-by: Bernhard Wiedemann <bwiedemann@suse.com>
+Tested-by: Bernhard Wiedemann <bwiedemann@suse.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Bernhard Wiedemann <bwiedemann@suse.com>
+Cc: Takashi Iwai<tiwai@suse.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read(
+
+ do {
+ status = usb_control_msg(udev, pipe, request, reqtype, value,
+- index, pdata, len, 0); /*max. timeout*/
++ index, pdata, len, 1000);
+ if (status < 0) {
+ /* firmware download is checksumed, don't retry */
+ if ((value >= FW_8192C_START_ADDRESS &&
--- /dev/null
+From 74856fbf441929918c49ff262ace9835048e4e6a Mon Sep 17 00:00:00 2001
+From: Mark Hounschell <dmarkh@cfl.rr.com>
+Date: Wed, 13 May 2015 10:49:09 +0200
+Subject: sd: Disable support for 256 byte/sector disks
+
+From: Mark Hounschell <dmarkh@cfl.rr.com>
+
+commit 74856fbf441929918c49ff262ace9835048e4e6a upstream.
+
+256 bytes per sector support has been broken since 2.6.X,
+and no-one stepped up to fix this.
+So disable support for it.
+
+Signed-off-by: Mark Hounschell <dmarkh@cfl.rr.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1599,6 +1599,7 @@ static unsigned int sd_completed_bytes(s
+ {
+ u64 start_lba = blk_rq_pos(scmd->request);
+ u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++ u64 factor = scmd->device->sector_size / 512;
+ u64 bad_lba;
+ int info_valid;
+ /*
+@@ -1620,16 +1621,9 @@ static unsigned int sd_completed_bytes(s
+ if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ return 0;
+
+- if (scmd->device->sector_size < 512) {
+- /* only legitimate sector_size here is 256 */
+- start_lba <<= 1;
+- end_lba <<= 1;
+- } else {
+- /* be careful ... don't want any overflows */
+- unsigned int factor = scmd->device->sector_size / 512;
+- do_div(start_lba, factor);
+- do_div(end_lba, factor);
+- }
++ /* be careful ... don't want any overflows */
++ do_div(start_lba, factor);
++ do_div(end_lba, factor);
+
+ /* The bad lba was reported incorrectly, we have no idea where
+ * the error is.
+@@ -2196,8 +2190,7 @@ got_data:
+ if (sector_size != 512 &&
+ sector_size != 1024 &&
+ sector_size != 2048 &&
+- sector_size != 4096 &&
+- sector_size != 256) {
++ sector_size != 4096) {
+ sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ sector_size);
+ /*
+@@ -2248,8 +2241,6 @@ got_data:
+ sdkp->capacity <<= 2;
+ else if (sector_size == 1024)
+ sdkp->capacity <<= 1;
+- else if (sector_size == 256)
+- sdkp->capacity >>= 1;
+
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
thermal-step_wise-revert-optimization.patch
md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch
md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch
+rtlwifi-rtl8192cu-fix-kernel-deadlock.patch
+input-elantech-fix-semi-mt-protocol-for-v3-hw.patch
+storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch
+sd-disable-support-for-256-byte-sector-disks.patch
+acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch
+drm-radeon-add-new-bonaire-pci-id.patch
+drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch
+drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch
+vfs-read-file_handle-only-once-in-handle_to_path.patch
+fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch
--- /dev/null
+From dc45708ca9988656d706940df5fd102672c5de92 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Fri, 1 May 2015 11:03:02 -0700
+Subject: storvsc: Set the SRB flags correctly when no data transfer is needed
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit dc45708ca9988656d706940df5fd102672c5de92 upstream.
+
+Set the SRB flags correctly when there is no data transfer. Without this
+change some IHV drivers will fail valid commands such as TEST_UNIT_READY.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Reviewed-by: Long Li <longli@microsoft.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/storvsc_drv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1625,8 +1625,7 @@ static int storvsc_queuecommand(struct S
+ break;
+ default:
+ vm_srb->data_in = UNKNOWN_TYPE;
+- vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN |
+- SRB_FLAGS_DATA_OUT);
++ vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER;
+ break;
+ }
+
--- /dev/null
+From 161f873b89136eb1e69477c847d5a5033239d9ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Wed, 28 Jan 2015 15:30:43 -0500
+Subject: vfs: read file_handle only once in handle_to_path
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 161f873b89136eb1e69477c847d5a5033239d9ba upstream.
+
+We used to read file_handle twice. Once to get the amount of extra
+bytes, and once to fetch the entire structure.
+
+This may be problematic since we do size verifications only after the
+first read, so if the number of extra bytes changes in userspace between
+the first and second calls, we'll have an incoherent view of
+file_handle.
+
+Instead, read the constant size once, and copy that over to the final
+structure without having to re-read it again.
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fhandle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd
+ goto out_err;
+ }
+ /* copy the full handle */
+- if (copy_from_user(handle, ufh,
+- sizeof(struct file_handle) +
++ *handle = f_handle;
++ if (copy_from_user(&handle->f_handle,
++ &ufh->f_handle,
+ f_handle.handle_bytes)) {
+ retval = -EFAULT;
+ goto out_handle;
projects / thirdparty / kernel / stable-queue.git / commitdiff
